René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Concurrent partial.__setstate__() can free args during flattening","articleBody":"**Description**\n\n`functools.partial.__setstate__()` independently replaces `fn`, `args`, `kw`, `dict`, `phcount`, and `vectorcall` without a critical section. `partial_new()`, `partial_call()`, and `partial_vectorcall()` read these fields and borrow tuple items without taking owned references to one coherent state. A setter can therefore release the old args tuple while another thread concatenates or indexes it, and readers can observe mixed state from different replacements.\n\n**Observed Behavior**\n\nOne thread repeatedly installed fresh valid states while seven threads called the partial and flattened it into another partial. The free-threaded ASan build crashed after 0.6 seconds in `tuple_concat()` from `partial_new()` at `Modules/_functoolsmodule.c:287`. The same executable completed 340,357 call/construction cycles in eight seconds with the GIL enabled.\n\n**Affected Version**\n\nCPython 3.14.7 at commit `823f0323ee6ec1402088b73bce1a38473cac36dc`, tested with a free-threaded ASan build.\n\n**Reproduction**\n\n```sh\nASAN_OPTIONS=abort_on_error=1:detect_leaks=0 PYTHON_GIL=0 python3.14 poc/reproduce.py 10\n```\n\nSetting `PYTHON_GIL=1` provides the GIL-enabled control.\n\n**PoC Source Code**\n\n`poc/reproduce.py`\n\n```python\nimport functools\nimport sys\nimport threading\nimport time\n\n\nclass Payload:\n    __slots__ = (\"data\",)\n\n    def __init__(self):\n        self.data = bytearray(8192)\n\n\ndef target_a(*args, **kwargs):\n    return len(args)\n\n\ndef target_b(*args, **kwargs):\n    return len(kwargs)\n\n\ndef fresh_state(turn):\n    func = target_a if turn & 1 else target_b\n    args = tuple(Payload() for _ in range(96))\n    return (func, args, {}, None)\n\n\nduration = float(sys.argv[1]) if len(sys.argv) > 1 else 10.0\nshared = functools.partial(target_a, *fresh_state(1)[1])\nstop = threading.Event()\ncounts = [0] * 7\n\n\ndef mutate():\n    turn = 0\n    while not stop.is_set():\n        shared.__setstate__(fresh_state(turn))\n        turn += 1\n\n\ndef exercise(slot):\n    while not stop.is_set():\n        try:\n            shared()\n            functools.partial(shared, Payload())\n            counts[slot] += 1\n        except (TypeError, ValueError):\n            pass\n\n\nthreads = [threading.Thread(target=mutate)]\nthreads.extend(threading.Thread(target=exercise, args=(i,)) for i in range(7))\nfor thread in threads:\n    thread.start()\ntime.sleep(duration)\nstop.set()\nfor thread in threads:\n    thread.join()\nprint(\"completed\", sum(counts))\n```\n","author":{"url":"https://github.com/Nievesjyl","@type":"Person","name":"Nievesjyl"},"datePublished":"2026-09-07T18:11:04Z","url":"https://github.com/python/cpython/issues/157099"}